2.2.1 Experiment Platform
In our experiments, we use fifteen commercial 45nm SOI test chips with 176kB data memory each to evaluate SRAM PUF, and 6 RO PUF chips with 13 RO pairs each for RO PUF evaluation. The frequencies of these RO pairs are measured and compared, so the response is 13 bits long for each PUF.
For arbiter PUF simulation, we gather 14 delay paths to form an arbiter PUF that are measured one time from a commercial 65nm technology process. There are 36 thousand arbiter PUFs from 23 wafer lots which contains 16 to 25 wafers each, and 90 arbiter PUFs are fabricated on each wafer. The exact location of each PUF is known for silicon variation analysis. The structure of the arbiter PUF used in our experiments is given in Figure 2.1. 2 of 14 delay paths are chosen to compare the timing difference, so each PUF can generate a 91-bit response. Since the focus of this work is to assess the impact of silicon correlations on PUFs but not the model building attacks, the arbiter PUF structure with each path specifically implemented is used.
Figure 2.1: The arbiter PUF structure for silicon variation evaluation.
2.2.2 Memory based PUF
A memory based PUF exploits the inherent threshold variation of the cross-coupled devices to generate random responses, which can be used as a unique fingerprint of the IC or random key generation. There are many implementations of memory based PUF on different storage techniques including SRAM PUF [12], Flash [16], DRAM [17], and Memristors [18]. Among these variations of memory based PUFs, SRAM PUF is considered to be one of the most popular types of PUFs because they are easy to manufacture. Therefore, the focus of our work on memory based PUF will be on SRAM PUF.
SRAM PUF is a primitive well suited for secure key generation because the key is not stored on a non-volatile memory and is derived only when needed, meaning that it is pre- sented only for a very short period of time. In a cryptographic secret key generation proce- dure, it is important that the key is generated with high randomness, and SRAM PUF shows a highly random response that has little fabrication correlation because the cross-coupled transistors are placed very closely to each other, which intrinsically cancel out the spatial correlations and systematic variations.
We evaluate the inter-distance distribution of SRAM PUF using fifteen commercial 45nm SOI test chips, where each consists 176kB data memory. The results show that the intra-
distance distribution is closely matched to a normal distribution with mean of 48.33%. This is expected since the response of SRAM PUF is highly random. For intra-distance measure- ment, the power-up state is measured 10 times during an 8-hour period, and the mean of intra-distance distribution is only 2.57%.
Because of the independence of each SRAM cell, it is not possible to predict SRAM PUFs using modeling or machine learning techniques. However, the states of SRAM cells are known to be observable by physical read-out utilizing laser stimulation even if care is taken to prevent the values from being revealed over standard channels. Therefore, the design of SRAM PUF must be tamper evident, meaning that the invasive attacks must alter the memory cell characteristics in such a way that the key derived from the PUF response becomes unrecoverable [19]. For rest of this chapter we focus on delay-based PUFs where the prominence of local variation is not guaranteed.
2.2.3 Delay based PUF
2.2.3.1 Arbiter PUF
The idea of an arbiter PUF [20] is to introduce a race condition on two paths and an arbiter circuit is used to decide which one of the two paths reached first. The two paths should be designed identically, then the outcome of the race will be unpredictable due to the inevitable manufacturing variations.
An arbiter PUF is often used as an authentication primitive because it is fast and has large CRP space. It is known to be vulnerable to model building attacks [21], but more complex configurations and restricted access in real application can reduce the risk greatly [22].
Please note that the comparison of the two path delays are done in a post processing procedure, so the arbiter circuit is assumed to be ideal. For real arbiter circuit such as a D flip-flop or a SR latch, a measurement noise coming from metastable behaviors will be discussed in section 2.4.
PUFs fabricated by a commercial 65nm technology process. The distribution is closely fit to a normal distribution with a FHD mean of 0.4998 and variance of 0.0297.
Figure 2.2: The FHD inter-distance of 36 thousand arbiter PUFs with mean=0.4998 and variance=0.0297.
2.2.3.2 Ring Oscillator (RO) PUF
A RO PUF consists ROs with the same intended frequency implemented in parallel. Similar to arbiter PUF, the two frequencies will be slightly different due to process variations, and a one-bit response is produced by comparing the frequencies [9]. RO PUF is often used as static cryptographic key generation because of its high cost of timing and power for each response generation.
We measure the inter-distance of 6 RO PUFs implemented as described in Section 2.1. Results shows that the mean of inter-distance is 54.36%.
For intra-distance measurement, each pair of ROs is measured 300 times over a 15-hour period. The results given in Table 2.1 which show that intra-distances varies from 0.3% to 18%. This could be due to many reasons including temperature or voltage variations, measurement uncertainties, or random noises. Detailed discussion on the sources of intra- distance noises will be presented in section 5.
Table 2.1: RO PUF Measurement Biasing Level Intra-Distance (mean)
PUF 1 84.6% 18.0% PUF 2 100.0% 6.6% PUF 3 76.9% 4.1% PUF 4 61.5% 6.6% PUF 5 76.9% 12.2% PUF 6 100.0% 0.3%
In addition to intra-distance, Table 2.1 also includes the biasing measurement, which is defined as the percentage of the majority bit value in a response. For example, PUF6 has a 100% biasing measurement, meaning that all the bits in the response are either ones or zeros. The results show that low intra-distance is an indication of high global correlation. This is an intuitive and interesting phenomenon. Small intra-distance means that the response is stable and resilient to noises, but it also means that the intrinsic difference is due to strong systematic correlations. In our RO PUF layout implementation, 26 ROs are evenly placed in two blocks, where a RO pair is formed by selecting two ROs from each of the block. It is possible that ROs from a block is always faster than ROs from the other block due to systematic wafer variation. Of course this biasing behavior can be eliminated or hidden by a more complex layout consideration, however, the physical silicon systematic variation will still occur and can be exploited as a side channel attack.